Ten Sleep School Board moves data privacy policy forward

TEN SLEEP – Monday evening, on first reading, the Ten Sleep School Board approved the Washakie County School District No. 2 Security and Privacy of Digital Infrastructure, Systems and Data policy in accordance with Wyoming Statute 21-2-202.

“Last legislative session a statute was passed requiring the district pass a policy concerning student data privacy and then we were told at the WBE (Wyoming Board of Education) [meeting] that the Department of Education would come out with some guidelines for us. Just a few weeks ago we got those guidelines. One of the stipulations was that we have to have a policy in place by January 1. So we have those guidelines, the guidelines are like 20 pages,” Ten Sleep School Superintendent Jimmy Phelps said.

According to the summary by the Legislative Service Office for House Enrolled Act 0014, current law requires the state superintendent of public instruction and Department of Enterprise Technology Services to develop a data security plan. The new law, “requires the state superintendent, in consultation with ETS and the Department of Audit, to establish guidelines for school districts for the collection, access, privacy, security and use of student data by school districts. Effective January 1, 2018, boards of trustees in each school district will be required to enforce a policy regarding the collection, access, privacy, security and use of student data in according with the guidelines.”

Much like Washakie County School District No. 1, the policy is brief and protocols, procedures and guidelines will be separate. “So as we make changes we are not having to come back and readdress the policy. We just add procedures, add protocols and so forth that would be necessary to ensure that our data is safe,” Ten Sleep School technology director Boyd Whitlock said.

Board member Jared Lyman said, “Looking it over, just like Boyd indicated, you’re talking about so many possible things to discuss, it makes sense to have this brief policy, it works for me.”

Board member Terril Mills asked Whitlock, “I think having a brief policy and having the procedures somewhere else is the right way. Is that what this is, just to protect data from being exposed or accessed by those who shouldn’t be there?”

“That is a component of it, it’s also to ensure that electronic records are being disposed of in a proper manner so that retention is within the state guidelines, so we are not storing stuff 50 years out. You want the keep the amount of storage to the required minimum so that you can effectively protect, more is not easier to protect,” Whitlock stated.

According to the policy, Washakie County School District No. 2 Board of Trustees along with responsible employees of the district will strive to implement K-12 best practices, protocols, processes, and procedures to ensure the security and privacy of our digital infrastructure, systems, and data in accordance with applicable federal and state laws, regulations, and guidelines.

The superintendent shall assure this implementation by assigning this duty to the director of technology, who under the general supervision of the Superintendent is responsible to provide for the creation and maintenance of digital security and privacy protocols, processes, and procedures to include:

— Access safeguards – administrative, physical, and logical security.

— Backup/redundancy.

— Data encryption.

— Disaster recovery.

— Identifying security and privacy concerns.

— Mitigation procedures.

— Response to security and privacy concerns.

— Retention and verifiable destruction of digital data.

— Risk assessment.

— Training for employees and student as applicable for security and privacy.